Effect of detector dead-times on the security evaluation of differential-phase-shift 
quantum key distribution against sequential attacks 
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We investigate limitations imposed by detector dead-times on the performance of sequential at- 
tacks against a differential-phase-shift (DPS) quantum key distribution (QKD) protocol with weak 
coherent pulses. In particular, we analyze sequential attacks based on unambiguous state discrim- 
ination of the signal states emitted by the source and we obtain ultimate upper bounds on the 
maximal distance achievable by a DPS QKD scheme both in the so-called trusted and untrusted 
device scenarios, respectively. 
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I. INTRODUCTION 

Quantum key distribution (QKD) [lj is a technique 
that allows two parties (usually called Alice and Bob) 
to generate a secret key despite the computational and 
technological power of an eavesdropper (Eve) who inter- 
feres with the signals. Together with the Vernam cipher 
Q, QKD can be used for unconditionally secure data 
transmission. 

The first complete QKD scheme was introduced by 
Bennett and Brassard in 1984 (BB84 for short) [|[. An 
unconditional security proof for the whole protocol has 
been given in Ref. Q ■ After the first demonstration of the 
feasibility of this scheme [f| , several long-distance imple- 
mentations of QKD have been realized in the last years 
(see, for instance, Ref. @ and references therein). How- 
ever, these practical approaches differ in many impor- 
tant aspects from the original theoretical proposal, since 
it demands technologies that are beyond our present ex- 
perimental capability. Especially, the signals emitted by 
the source, instead of being single-photons, are usually 
weak coherent pulses (WCP) with typical average pho- 
ton numbers of 0.1 or higher. This fact, together with 
the considerable attenuation introduced by quantum the 
channel and the noise introduced by the detectors, jeop- 
ardize the security of the protocol and lead to limitations 
of rate and distance that can be covered by these tech- 
niques @, [|| ■ A positive security proof against all indi- 
vidual attacks,even with practical signals, has first been 
given in Ref. [9(, while a complete proof of the uncon- 
ditional security of this scheme in a realistic setting has 
been provided in Refs. [l(| E|- This means that, despite 
practical restrictions, with the support of the classical in- 
formation techniques (error correction and privacy am- 
plification) used in the key distillation phase, it is still 
possible to obtain a secure secret key. 



The main security threat of QKD protocols based on 
WCP arises from the fact that some signals contain more 
than one photon prepared in the same polarization state. 
Now, Eve can perform, for instance, the so-called Pho- 
ton Number Splitting (PNS) attack on the multi-photon 
pulses 0- This attack provides Eve with full informa- 
tion about the part of the key generated from the multi- 
photon signals, without causing any disturbance in the 
signal polarization. As a result, it turns out that the 
BB84 protocol with WCP can give a key generation rate 
of order 0(r] 2 ), where ij denotes the transmission effi- 
ciency of the quantum channel fiol . [TTj] . 

To obtain higher secure key rates over longer distances, 
different QKD schemes, that are robust against the PNS 
attack, have been proposed in recent years. One of these 
schemes is the so-called decoy-states [HI, [d| , where Al- 
ice varies at random the mean photon number of the 
signal states sent to Bob by using different intensity set- 
tings. This technique delivers a key generation rate of 
order 0(rj) [l2|, [Hj]. Another possibility is based on the 
transmission of two non-orthogonal coherent states to- 
gether with a strong reference pulse 14]. This scheme 
has been analyzed in detail in Ref. |l5|, where it was 
confirmed that also in this scenario the secure key rate 
is of order 0(rf). Finally, another possible approach 
is to use a different ial-p hase-shift (DPS) QKD protocol 
0, E3, E El, [H [S( . In this scheme Alice sends to 
Bob a train of WCP whose phases are randomly mod- 
ulated by or 7r. On the receiving side, Bob measures 
out each incoming signal by means of an interferome- 
ter whose path-length difference is set equal to the time 
difference between two consecutive pulses. In this last 
case, however, a secure key rate of order 0(rf) has only 
been proven so far against a special type of individual 
attacks where Eve acts and measures photons individu- 
ally, rather than signals [l7j . and also against a partic- 
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ular class of collective attacks where Eve attaches an- 
cillary systems to each pulse or to each pair of succes- 
sive pulses 22]. While a complete security proof of DPS 
QKD against the most general attack is still missing, 
recently it has been shown that sequential attacks al- 
ready impose strong restrictions on the performance of 
this QKD scheme with WCP [13, IS3|- For instance, 
it was proven in Refs. [Illlthat the DPS QKD exper- 
iments reported in Refs. [la 13 are insecure against this 
type of attacks. Basically, a sequential attack consists 
of Eve measuring out every signal state emitted by Alice 
and, afterwards, she prepares new signal states, depend- 
ing on the results obtained, that are given to Bob. When- 
ever Eve obtains a predetermined number of consecutive 
successful measurement outcomes, then she prepares a 
train of non-vacuum signal states that is forwarded to 
Bob. Otherwise, Eve sends, for instance, vacuum signals 
to Bob to avoid errors. Sequential attacks constitute a 
special type of intercept-resend attacks [25|, [2y, [27| and, 
therefore, they provide ultimate upper bounds on the 
performance of QKD schemes [28[ . 

In discussions within the scientific community one of- 
ten hears, however, that the security analysis presented 
in Refs. 0, [24[ might have overestimated the strength 
that sequential attacks have against a DPS QKD proto- 
col. This conjecture is justified because the sequential 
attacks studied so far in the literature have not consid- 
ered the effect of Bob's detectors dead-time. As a result, 
the probability that each non- vacuum signal state, within 
a train of them, sent by Eve contributes to the sifted key 
does not depend on whether the previous signal states 
in the train already produced a click on Bob's detection 
apparatus or not. This suggests that such analysis might 
overestimate the number of Bob's detected events that 
originates from the non- vacuum signal states sent by Eve 
and, therefore, it might deliver shorter secure distances. 

The aim of this paper is to investigate limitations im- 
posed by Bob's detectors dead-time on the performance 
of sequential attacks against a DPS QKD protocol [29(. 
For that, we shall analyze sequential attacks based on 
unambiguous state discrimination (USD) of the signal 
states emitted by Alice [H, H [H, [H |3l[ . When Eve 
identifies unambiguously a signal state, then she consid- 
ers this result as successful. Otherwise, she considers it a 
failure. We shall consider two possible scenarios for our 
analysis. The first one, so-called untrusted device sce- 
nario, arises from a conservative definition of security, 
i.e., we shall assume that Eve can control some imper- 
fections in Alice and Bob's devices (e.g., the detection 
efficiency, the dark count probability, and the dead-time 
of Bob's detectors), together with the losses in the quan- 
tum channel, and she exploits them to obtain maximal 
information about the shared key. In the second scenario, 
so-called trusted device scenario, we shall consider that 
Eve cannot modify the actual detection devices employed 
by Alice and Bob. That is, the legitimate users have com- 
plete knowledge about their detectors, which are fixed 
by the actual experiment. The main motivation to study 




FIG. 1: Basic setup of a DPS QKD scheme. PM denotes a 
phase modulator, BS, a 50 : 50 beam splitter, M, a mirror, 
DO and Dl are two photon detectors and At represents the 
time difference between two consecutive pulses. 



this scenario is that, from a practical point of view, it 
constitutes a reasonable description of a realistic situa- 
tion, where Alice and Bob can limit Eve's influence on 
their apparatus by some counterattack techniques [32| . 

A different QKD scheme, but also related to a DPS 
QKD protocol, has been proposed recently in Ref. 
(See also Ref. Hi|-) However, since the abstract signal 
structure of this protocol is different from the one of a 
DPS QKD scheme, the analysis contained in this pa- 
per does not apply to that scenario. Sequential attacks 
against the QKD protocol introduced in Ref. [33[ have 
been investigated in Ref. [35j , while its security against a 
particular class of collective attacks has been studied in 
Ref. 

The paper is organized as follows. In Sec. |TT] we de- 
scribe in more detail a DPS QKD protocol. Then, in 
Sec. IIII1 we present sequential attacks against this QKD 
scheme. Section IIVI includes the analysis for the un- 
trusted device scenario. Here we obtain an upper bound 
on the maximal distance achievable by a DPS QKD pro- 
tocol as a function of the error rate in the sifted key, 
the mean photon-number of Alice's signal states and the 
dead-time of Bob's detectors. Similar results are de- 
rived in Sec. [Vj now for the trusted device scenario. Fi- 
nally, Sec. I VII concludes the paper with a summary. The 
manuscript includes as well several appendices with ad- 
ditional calculations. 



II. DIFFERENTIAL-PHASE-SHIFT (DPS) QKD 



The setup is illustrated in Fig. Q] [16|, UJ\, UM UJ, l2Q|, l21| . 
Alice prepares first a train of coherent states \a) and, af- 
terwards, she modulates, at random and independently 
every time, the phase of each pulse to be or it. As a 
result, she produces a random train of signal states \a) or 
| — a) that are sent to Bob through the quantum chan- 
nel. On the receiving side, Bob uses a 50 : 50 beam split- 
ter to divide the incoming pulses into two possible paths 
and then he recombines then again using another 50 : 50 
beam splitter. The time delay introduced by Bob's inter- 
ferometer is set equal to the time difference At between 
two pulses. Whenever the relative phase between two 
consecutive signals is (±7r) only the photon detector 
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DO (Dl) may produce a "click" (at least one photon is 
detected). For each detected event, Bob records the time 
slot where he obtained a click and the actual detector 
that fired. 

Once the quantum communication phase is completed, 
Bob uses a classical authenticated channel to announce 
the time slots where he obtained a click, but he does not 
reveal which detector fired each time. From this informa- 
tion provided by Bob, together with the knowledge of the 
phase value used to modulate each pulse, Alice might in- 
fer which photon detector had clicked at Bob's side each 
given time. Then, Alice and Bob can agree, for instance, 
to select a bit value "0" whenever the photon detector 
DO fired, and a bit value "1" if the detector Dl clicked. 
In an ideal scenario, Alice and Bob end up with an iden- 
tical string of bits representing the sifted key. Due to the 
noise introduced by the quantum channel, together with 
possible imperfections of Alice and Bob's devices, how- 
ever, the sifted key typically contains some errors. Then, 
Alice and Bob perform error-correction to reconcile the 
data and privacy amplification to decouple the data from 
Eve. (See, for instance, Ref. [l[.) 



III. SEQUENTIAL ATTACKS AGAINST DPS 
QKD 

A sequential attack can be seen as a special type of 
intercept-resend attack [13, HEI13]- First, Eve measures 
out every coherent state emitted by Alice with a detection 
apparatus located very close to the sender. Afterwards, 
she transmits each measurement result through a lossless 
classical channel to a source close to Bob. Whenever Eve 
considers a sequence of measurement outcomes success- 
ful, this source prepares a new train of signal states that 
is forwarded to Bob. Otherwise, Eve typically sends vac- 
uum signals to Bob to avoid errors. Whether a sequence 
of measurement results is considered to be successful or 
not, and which type of non- vacuum signal states Eve 
sends to Bob, depends on Eve's particular eavesdropping 
strategy and on her measurement device. Sequential at- 
tacks transform the original quantum channel between 
Alice and Bob into an entanglement breaking channel 
and, therefore, they do not allow the distribution 
of quantum correlations needed to establish a secret key 

Let us begin by introducing Eve's measurement appa- 
ratus. As mentioned previously, we shall consider that 
Eve realizes USD [30l l3ll | of each signal state sent by 
Alice. That is, whenever she obtains a conclusive result 
then it is guaranteed that the result is always correct. 
In order to do that, we will assume that Eve has always 
access to a local oscillator that is phase-locked to the co- 
herent light source employed by Alice [13] • Whenever Eve 
identifies unambiguously a predetermined number of con- 
secutive signal states, i.e., she determines without error 
whether each signal state is |a) or | — a), she considers 
this sequence of measurement outcomes successful. Oth- 



erwise she considers it a failure [38| . We define the integer 
parameter M m i n as the minimum number of consecutive 
USD successful results that Eve needs to obtain in order 
to consider the sequence of measurement outcomes suc- 
cessful. More precisely, if k > denotes the total number 
of consecutive USD successful outcomes obtained by Eve 
before she obtains an inconclusive result, then, whenever 
k > M m i n , Eve prepares a new train of signal states, that 
we shall denote as p k e , together with some vacuum states 
for the inconclusive result, and she sends these signals to 
Bob. The precise definition of the quantum state p k e will 
be introduced later on, since it will depend on whether 
we consider the untrusted or the trusted device scenario, 
respectively. The reason to append some vacuum states 
to each train of signal states p k is also closely related to 
the eavesdropping strategy of these two possible cases. 
The main idea behind this procedure is to guarantee that 
whenever Bob obtains a click on his detection apparatus 
then he cannot obtain any other click afterwards during 
a period of time at least equal to the dead-time of his 
detectors. That is, these vacuum states sent by Eve will 
allow her to reproduce the dead-time of Bob's detectors, 
whose influence on the security evaluation of a DPS QKD 
protocol is the main focus of this paper. For simplicity, 
let us assume for the moment that Eve sends to Bob 
1 + d vacuum states together with each train of signal 
states p k in order to achieve this goal, while the precise 
value of the parameter d will be given for the untrusted 
(trusted) device scenario in Sec. |IV] (Sec. [V}. On the 
other hand, if k < M m i n Eve sends to Bob k + 1 vacuum 
states, where the last vacuum state corresponds to Eve's 
inconclusive result. The case k = M min deserves special 
attention. We shall consider that in this situation Eve 
employs a probabilistic strategy that combines the two 
previous ones. In particular, we assume that Eve sends to 
Bob the signal state p^ Imin , together with 1 + d vacuum 
states, with probability q and, with probability 1 — q, she 
sends to Bob M m i n + 1 vacuum states. That is, the pa- 
rameter q allows Eve to smoothly fit her eavesdropping 
strategy to the observed data [23j. Moreover, in order to 
simplify our calculations, we define the integer parameter 
M max > M m i n as the maximum number of consecutive 
USD successful results that Eve can obtain in order to 
send to Bob a train of signal states. That is, whenever 
Eve obtains M max consecutive USD successful outcomes 
then she discards the next measurement outcome and di- 
rectly sends to Bob the quantum state p^ ma ^ together 
with 1 + d vacuum states for the discarded measurement 
result. 

Let p denote the probability that Eve obtains an USD 
successful result per signal state sent by Alice. It has the 
following form [30( 

p = l-\{a\-a)\ =l-exp(-2/i a ), (1) 

where p a represents the mean photon-number of Alice's 
signal states, i.e., p a = \a\ 2 . 

We shall denote with p s (k) the probability that Eve 
sends to Bob a train of signal states p k , together with 
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FIG. 2: Possible signal states that Eve sends to Bob together 
with their a priori probabilities. The arrow indicates the 
transmission direction. 



l + d vacuum states. This probability can be written as 
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p) if M min <k <M„ 

if k — M m ax 

otherwise, 



(2) 



with p given by Eq. ([I]) . Similarly, we shall denote with 
p v (k) the probability that Eve sends to Bob k+1 vacuum 
states. This probability is given by 



Pv(k) = 



p k (l~p) 
(1 - q )p M " 




if < k < M„ 
iik = M min 
otherwise. 



(3) 



We illustrate all these possible cases in Fig. [2j where we 
also include the different a priori probabilities to be in 
each of these scenarios. 

Next we analyze in detail the influence that Bob's de- 
tectors dead-time has on the performance of the sequen- 
tial attack introduced above. The goal is to find an ex- 
pression for the gain, i.e., the probability that Bob ob- 
tains a click per signal state sent by Alice, together with 
the quantum bit error rate (QBER) introduced by Eve, 
in both the untrusted and the trusted device scenarios, 
respectively. 



IV. UNTRUSTED DEVICE SCENARIO 

Here we shall consider that Eve can always control 
some imperfections in Alice and Bob's devices together 
with the quantum channel. Especially, we shall assume 
that Eve can always replace Bob's imperfect detection 



apparatus by an ideal one in order to exploit its detec- 
tion efficiency, together with the dark count probability 
and the dead-time of his detectors, to obtain maximal in- 
formation about the shared key. Of course, to guarantee 
that Eve's presence remains unnoticeable to the legiti- 
mate users, Eve needs to send Bob signal states that can 
reproduce the statistics that Alice and Bob expect after 
their measurements. For this, we shall consider the stan- 
dard version of a DPS QKD protocol, where Alice and 
Bob only monitor the raw bit rate (before the key distil- 
lation phase) together with the time instances in which 
Bob obtains a click. 

The main limitation on the type of signal states that 
Eve can send to Bob in this scenario arises from the dead- 
time of Bob's detectors. In order to simplify our analysis 
we shall assume that both detectors DO and Dl in Fig.[T] 
are indistinguishable, i.e., their dark count rate, quan- 
tum efficiency and dead-time, are equal. Moreover, we 
shall consider a conservative scenario where every time 
that one of these detectors clicks, then both detectors do 
not respond to any other incident photon during a period 
of time equal to the dead-time, i.e., we shall assume that 
after a click both detectors suffer simultaneously from 
a dead time. This is a key assumption underlying the 
whole analysis presented in this paper. In the exper- 
imental setup employed in Refs. [HI, QjJ H3, HH both 
detectors DO and Dl are connected to the same Time 
Interval Analyser (TIA) that also has a dead-time which 
is typically much higher than the dead-time of the de- 
tectors. Whenever one of these detectors clicks then the 
TIA does not respond to any other click event during a 
period of time equal to its dead-time. In this situation, 
however, if DO and Dl do not suffer simultaneously from 
a dead-time, then the effect of the TIA can be understood 
as just blocking some of the output signals coming from 
the two detectors. As a result, the raw key obtained by 
Alice and Bob could contain correlations between differ- 
ent bits which might be known to some extend to Eve. 
For instance, if one detector clicks, and the clock fre- 
quency of the system is high enough, then, because of its 
dead-time, it is more probable that the next click comes 
from the other detector. This last scenario is beyond the 
scope of this paper and the analysis will be presented 
somewhere else. 



In the sequential attack introduced in Sec. IIIH Eve 
sends to Bob only two possible classes of signal states: a 
state p k followed by I + d vacuum states, or a train of 
k + 1 vacuum signals. This means, in particular, that 
Bob can only obtain clicks in his detection apparatus 
when he receives a signal state p k . To be able to mimic 
the dead-time of Bob's detectors, therefore, Eve needs to 
select each state p k such that it can produce only one 
click on Bob's side within a dead-time period. For that, 
Eve chooses p k containing only one photon distributed 
among k temporal modes. These modes correspond to 
k consecutive pulses sent by Alice, i.e., the time differ- 
ence between two consecutive temporal modes in p k is set 
equal to the time difference At between two consecutive 
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Next, we obtain an expression for the gain and for the 
QBER introduced by Eve in this scenario. 
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FIG. 3: Labeling convention for the k temporal modes of the 
signal state \ipk) given by Eq. followed by 1 + d vacuum 
states. The arrow indicates the transmission direction. 



pulses sent by Alice. More precisely, we shall consider 
that ,0g denotes a pure state (i.e., p k e = IV'eXV'el) 
given by 

l^)-E A «' )ex P^«)4|0), (4) 

n=l 

a (k) 

with A„ G C and where the normalization condition 
J2 n =i 1^"^ | 2 = 1 is always satisfied. The angles 9 n ful- 
fill 9 n = if the signal state identified by Eve's USD 
measurement at the time instance n is \a) and 6 n = tt 
if the signal state identified by Eve is | — a) , the opera- 
tor a n represents a creation operator for one photon in 
temporal mode n, and the state |0) refers to the vacuum 
state. Eq. (HJ) considers the possibility of using different 
amplitudes A n ' for the resent signals, following the spirit 
of Ref. [24| . The superscript k labeling the coefficients 

(k) 

A n emphasizes the fact that the value of these coeffi- 
cients may depend on the number of temporal modes k 
contained in \ip^). Moreover, from now on we will use 
the convention that the first temporal mode of \ip k ) that 
arrives at Bob's detection device is mode n = k, while 
the last one is mode n = 1. This labeling convention is 
illustrated in Fig. [3] 

Let us now determine the minimum number, 1 + d, 
of vacuum states that Eve needs to send to Bob after 
each signal state \ip k ). From the previous paragraph we 
learn that whenever Bob receives a state \ip k ) satisfying 
Eq. ([4J then he obtains one single click in his detection 
device. This click can occur, however, in any temporal 
mode n, with n e [0, k] [39]. The minimum value of the 
parameter d can be calculated from the case where Bob 
obtains a click in the last possible temporal mode, i.e., 
n = Q (see Fig. Let us assume that such a click occurs, 
and let td and f c denote, respectively, the dead-time of 
Bob's detectors and the clock frequency of the system. To 
guarantee that Bob cannot obtain any other click from a 
following signal state until td finishes we find that d has 
to fulfill d > [td/cl • That is, the parameter d has to be 
larger than or equal to the number of signal states sent 
by Alice within a period of time equal to the dead-time. 
From now on we shall consider that Eve selects d such 
that 

d=\t d fc]- (5) 



The gain, that we shall denote as G, of a sequential 
attack is defined as the probability that Bob obtains a 
click per signal state sent by Alice. It can be expressed 
as G = Ndicks/N, where N c u cks represents the average 
total number of clicks obtained by Bob, and N is the 
total number of signal states sent by Alice. The parame- 
ter N cUcks can be expressed as N cUcks = (N/N e )N* licks , 
with N e denoting the average total number of pulses of 
signal states sent by Eve (see Fig. [2]), and where N^ licks 
represents the average total number of clicks obtained by 
Bob when Eve sends to him precisely these signal states. 
With this notation, the gain of a sequential attack can 
be written as 

N e 

G = chcks . (6) 

N e V I 

Next, we obtain an expression for N^ licks and N e . Let 
us begin with N%- hs . Whenever Eve sends to Bob a 
signal state \ip k ) followed by 1 + d vacuum states (Cases 
A, B, and C in Fig. [2J) Bob always obtains one click in his 
detection apparatus. On the other hand, if Eve sends to 
Bob only vacuum states (Cases D and E in Fig. [5]) Bob 
never obtains a click. This means, in particular, that 
^clicks can b e expressed as 

Kucks= E P°W> ( ? ) 
k=M min 

with p s (k) given by Eq. ©. This expression can be fur- 
ther simplified as 

Nt Ucks =[q+(l-q)p\p M —. (8) 

The analysis to obtain N e is similar. A signal state 
\ip k ) followed by 1 + d vacuum states can be seen as con- 
taining k + 1 + d pulses. On the other hand, the number 
of vacuum pulses alone that Eve sends to Bob can vary 
from 1 to M m in + 1 (see Fig. [2]). Adding all these terms 
together, and taking into account their a priori probabil- 
ities, we obtain that N e can be written as 

M maI 

N e = J2 ^( fc )( fc + 1) +P.(*)(* + 1 +d), (9) 

k=0 

with p v (k) given by Eq. ([3]). This expression can be sim- 
plified as 

e _ d[q + (1 - 2q)p - (1 - g)p 2 ]p M — - p M — + l + 1 

l-p 

( 10 ) 

The gain G can be related with a transmission distance 
I for a given QKD scheme, i.e., a distance which provides 
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an expected click rate at Bob's side given by G. This last 
condition can be written as 



Untrusted device scenario: fi a =0.2, d=500, 



G = 1 - exp (—(iaVdetVt), 



(11) 



where r\aet represents the detection efficiency of the detec- 
tors employed by Bob, and rj t denotes the transmittivity 
of the quantum channel. In the case of a DPS QKD 
scheme, the value of r\ t can be derived from the loss co- 
efficient 7 of the optical fiber measured in dB/km, the 
transmission distance I measured in km, and the loss in 
Bob's interferometer L measured in dB as 



m = io- 



(12) 



From Eq. (| 1 1 1) and Eq. (| 1 2|) , we find that the transmission 
distance I that provides a gain G is given by 



1 



10 log 



10 



In (1 - G) 

l^aVdet 



(13) 



B. Quantum bit error rate 

The QBER, that we shall denote as Q, is defined 
as Q = Nerrors/Nciicks, where N errors represents the 
average total number of errors obtained by Bob, and 
N c iicks is again the average total number of clicks at 
Bob's side. The parameter N errors can be expressed as 
N errors = (N '/ 'N e )I\ *l r rorsi with ^errors denoting the av- 
erage total number of errors obtained by Bob when Eve 
sends him the different signal states considered in her 
strategy (see Fig.|2J|. With this notation, and using again 
the fact that N c i ic k s = {N/N e )N^ licks , we obtain that the 
QBER of a sequential attack can be expressed as 

■ , r VWJf (14) 



N 



clicks 



The parameter N^ licks was calculated in the previous sec- 
tion and it is given by Eq. I[8|). Let us now obtain an ex- 
pression for Nerrors- We shall distinguish the same cases 
like in the previous section, depending on the type of sig- 
nal states that Eve sends to Bob. Whenever Eve sends to 
Bob a signal state followed by 1 + d vacuum states 
(Cases A, B, and C in Fig. [2]) then we shall denote the av- 
erage total number of errors in this scenario as e(k). On 
the other hand, if Eve sends to Bob only vacuum states 
(Cases D and E in Fig. \2§ Bob never obtains an error. 
This means, in particular, that N^ rrors can be expressed 
as 



M„ 



=M m , 



p s {k)e(k). 



(15) 



k < M m ax, can be 



The parameters e(k), with M m in < 
obtained from the signal states together with the 

detection device used by Bob. They are calculated in 
Appendix [X] and are given by 



e(k) = - 



fc-i 



(fc)|2 



(fc) 



1-4 



W|2 



(16) 




FIG. 4: Gain (G) versus QBER in a sequential attack for 

( k) 

three different distributions of the state coefficients A n : flat 
(solid), binomial (dashed), and the optimal distribution (dot- 
ted). The mean photon number of Alice's signal states is 
fi a = 0.2, and the parameter d = 500. The triangles repre- 
sent experimental data from Ref. [2lj . 



C. Evaluation 

We have seen above that a sequential attack can be 
parametrized by the minimum number M min of consec- 
utive USD successful results that Eve needs to obtain in 
order to consider the sequence of measurement outcomes 
successful, the maximum number M max of consecutive 
successful results that Eve can obtain in order to send to 
Bob a train of signal states, the value of the probability 
q, i.e., the probability that Eve actually decides to send 
to Bob the signal state \%p^ Imin ) followed by 1 + d vacuum 
states instead of M min + 1 vacuum states, and the state 
coefficients A^Jf 1 € C that characterize the signal states 

\tp*), With M min <k< M m ax ■ 

Figures Q] [5j [5] and [7] show a graphical representation 
of the Gain versus the QBER in this sequential attack for 
different values of the mean photon-number [i a of Alice's 
signal states, the parameter d, and the state coefficients 
An ■ R states that no key distillation protocol can pro- 
vide a secret key from the correlations established by the 
users above the curves, i.e., the secret key rate in that re- 
gion is zero. In these examples we consider three possible 

(k) 

distributions for A n : the flat distribution, the binomial 
distribution, and we also calculate the optimal distribu- 
tion, i.e., the one which provides the lowest QBER for a 
given value of the Gain. The corresponding state coeffi- 
cients for these distributions are given by 



Flat: Al* 



1 



, for all n £ [1, k], 



Binomial: A^ = ( -^= 
\V2 



k-l 




(17) 



while the method to obtain the optimal distribution is de- 
scribed in Appendix [B] Figures |H O [U and [7] assume as 
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Untrusted device scenario: (i a =0.17, d=50, M max =25 Untrusted device scenario: n a =0.2, d=50, M max =25 




Log 10 (G) Log 10 (G) 



FIG. 5: Gain (G) versus QBER in a sequential attack for 

three different distributions of the state coefficients Ah : flat 
(solid), binomial (dashed), and the optimal distribution (dot- 
ted). The mean photon number of Alice's signal states is 
fj, a — 0.17, and the parameter d = 50. The triangles repre- 
sent experimental data from Ref. [Isl ]. (See also Ref. [13].) 



FIG. 7: Gain (G) versus QBER in a sequential attack for 

( k) 

three different distributions of the state coefficients A n : flat 
(solid), binomial (dashed), and the optimal distribution (dot- 
ted). The mean photon number of Alice's signal states is 
fi a = 0.2, and the parameter d = 50. The triangles represent 
experimental data from Ref. fl9| . (See also Ref. [2p|].) 
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Untrusted device scenario: fi H =0.16, d=50, M max =25 
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FIG. 6: Gain (G) versus QBER in a sequential attack for 
three different distributions of the state coefficients A?': flat 
(solid), binomial (dashed), and the optimal distribution (dot- 
ted). The mean photon number of Alice's signal states is 
jj, a = 0.16, and the parameter d — 50. The triangle repre- 
sents experimental data from Ref. [l8| ]. (See also Ref. [2(J.) 



well that M max is fixed and given by M max = 25, and we 
vary the parameters M min < M max and q € [0, 1 ], They 
also include experimental data from Refs. [la.Tl9L 
For instance, in the experiment reported in Ref. 
dead-time of Bob's detectors is td — 50 ns and the clock 
frequency of the system is f c = 10 GHz. From Eq. ([5]) 
we obtain, therefore, that d = 500. (See Fig. 01) Simi- 
larly, in the experiments realized in Refs. [ll| Ell H3| we 
have that td — 50 ns and f c = 1 GHz. This means, in 
particular, that in all these cases d = 50. (See Figs. 
[5] and [71 ) According to our results it seems that all the 



201 if. 

2l| the 



long-distance implementations of DPS QKD reported in 



Refs. [HEIHi 

l2l| would be insecure against a sequen- 
tial attack in the untrusted device scenario. That is, 
there exists no improved classical communication proto- 
col or improved security analysis which might allow the 
data of Refs. [H, [l|| [2(| HlJ to be turned into secret key. 



V. TRUSTED DEVICE SCENARIO 

In this section we impose constraints on Eve's capa- 
bilities, and we are interested in the effect that these 
constraints have on her eavesdropping strategy. In par- 
ticular, we study the situation where Eve is not able to 
manipulate Alice and Bob's devices at all, but she is lim- 
ited to act exclusively on the quantum channel (See, e.g., 
Refs. [25j, |4fJ). That is, we shall consider that the detec- 
tion efficiency, the dark count probability, and the dead- 
time of Bob's detectors are now fixed by the actual ex- 
periment, and Eve cannot influence them to obtain extra 
information about the shared key. The main motivation 
to analyze this scenario is that, from a practical point of 
view, it constitutes a reasonable description of a realistic 
situation, where Alice and Bob could in principle limit 
Eve's influence on their apparatus by some counterattack 
techniques [32| . Moreover, this could only enhance Alice 
and Bob's ability to distill a secret key. 

The detection efficiency r/det of Bob's detectors typi- 
cally satisfies r/det < 1- Therefore, in this scenario, Eve 
might be interested in sending Bob multi-photon signals, 
instead of single-photon states like in Sec. IIV1 in order 
to increase the gain. Moreover, as mentioned above, we 
assume now that the dead-time of Bob's detectors is al- 
ready present in DO and Dl and Eve does not need to 
select her signal states such that they can reproduce it. 
These two facts motivate the following definition for the 



8 



signal states p k in this case. In particular, we shall con- 
sider that p k consists of a classical mixture of pure states, 
that we shall denote as \ip™), containing m > 1 photons 
that are distributed among k temporal modes, i.e., 

oo 

^ = $> m ivrxvn (is) 

m— 1 

with the photon-number probabilities p m satisfying 
J2m=iP m = 1 [41(1 • The states |i/>™) are defined as 

(J,1 ) m 

m= vnpJ_ lQ)i (19) 

V ti! 

with |0) representing the vacuum state, and where the 
operators i/^ m are given by 

fc 

< m = E A «l ex p(^) a «- ( 2 °) 

n=l 

As before, a) n represents a creation operator for one pho- 
ton in temporal mode n, and the coefficients A^ m sat- 
isfy the normalization condition J2n=i l^ivm| 2 = 1- The 
superscript k and the subscript m labeling these coeffi- 
cients are used to emphasize that the value of An' m may 
depend, respectively, on the number of temporal modes 
k, and on the number of photons m, contained in \^p k n ). 
Moreover, like in Sec. IIV[ we shall consider that the time 
difference between two consecutive temporal modes in 
is set equal to the time difference At between two 
consecutive pulses sent by Alice. The definition of 9 n in 
Eq. ([20]) is also equal to the one provided for these angles 
in Sec. HVl That is, 9 n — if the signal state identified 
by Eve's USD measurement at the time instance n is \a), 
and 8 n = it if the state identified by Eve is | — a) . Be- 
sides, since Eve does not need to choose an eavesdropping 
strategy that reproduces Bob's detectors dead-time, the 
number of vacuum states that she sends to him following 
each signal state p\ can be set equal to one, i.e., we will 
assume that d = in Fig. [21 This vacuum state corre- 
sponds to the inconclusive result. Of course, Eve could 
choose as well an eavesdropping strategy where the pa- 
rameter d satisfies d > 0; this strategy would only cause 
that the value of the gain decreases and, therefore, it 
would also diminish the strength of Eve's attack. Finally, 
for simplicity, we shall consider that the parameter M max 
satisfies M max < [t<j/ c "|. This condition guarantees that, 
within each of the blocks of signal states illustrated in 
Fig. [21 Bob can obtain, at most, only one click in his 
detection apparatus. 

Next, we obtain an expression for the gain and for 
the QBER introduced by Eve in this scenario. We will 
analyze as well the resulting double click rate at Bob's 
side in this eavesdropping strategy. Note that now the 
double click rate obtained by Bob may increase due to 
the multi-photon signals used by Eve. 



A. Gain 

As shown previously, in this sequential attack the gain 
is given by Eq. ©. However, the analysis to obtain an ex- 
pression for the parameters N^ Hcks and N e is now slightly 
different from the one considered in Sec. HVl where Bob's 
detectors dead-time was reproduced by the signal states 
sent by Eve. In particular, now we need to include the 
effect of the dead-time of Bob's detectors in the detec- 
tion model. Moreover, in this scenario Bob can obtain as 
well double clicks in his detection apparatus. We shall 
consider that these double click events are not discarded 
by Bob, but they contribute to the raw key. Every time 
Bob obtains a double click, he just decides randomly the 
bit value [Hj]. 

Let us start by considering again the type of signal 
states that Eve sends to Bob in this strategy. These 
signals are illustrated in Fig. [21 where the states p k are 
given by Eq. (|18[) and the parameter d — 0. However, 
once Bob's detectors are recovered from a dead-time pro- 
duced by a previous click, the first temporal mode that 
arrives at Bob's side at this time instant might not coin- 
cide with the first temporal mode of any of the blocks of 
signal states considered in Fig. [21 This first mode could 
be, in principle, any of the temporal modes contained in 
these blocks of signal states. For instance, it could be 
any of the k temporal modes contained in p k . Note that 
this last case was never possible in the scenario analyzed 
in Sec. IIVI Figure [5] shows a graphical representation 
of the possible blocks of signal states that can arrive at 
Bob's side after a dead-time. These blocks of signals are 
just obtained from those illustrated in Fig. [5] by discard- 
ing some of their first temporal modes. For example, the 
block which contains only one vacuum state (Case A in 
Fig. [8]) could arise from every block of signals considered 
in Fig. [21 just by discarding all their temporal modes ex- 
cept the last one. The block composed by two vacuum 
states (Case C in Fig. [8]) could originate from any block 
of signals in Fig. [2] that contains at least two vacuum 
states at the end of the block (Cases D and E in Fig. [2] 
when d = 0), and so on. The a priori probabilities of 
the different blocks of signals illustrated in Fig. [8l that 
we shall denoted as q(k), r(k), and s(k), respectively, 
are calculated in Appendix [Cl The superscript k, with 
1 < k < M max , that labels the states p\ in Fig. [5] is used 
to emphasize the fact that these signals may correspond 
to the last k temporal modes of any signal state p k with 
k>k. 

The parameters N£ Hcks and N e can now be expressed, 
respectively, as 

oo 

Kucks = £ P m N e cllcks {m), (21) 

m— 1 

where N^ licks {m) denotes the average total number of 
clicks obtained by Bob when he receives the different 
blocks of signal states illustrated in Fig. [5] with p k be- 
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FIG. 8: Possible signal states arriving at Bob's detection ap- 
paratus after a dead-time, together with their a priori proba- 
bilities. The arrow indicates the transmission direction. 



ing the last k temporal modes of any state |^/?), and 

oo 

N e =J2p™N e (m), (22) 

m— 1 

with N e (m) representing the average total number of 
pulses caused by these blocks of signal states. That is, to 
calculate N e (m) we need to consider not only the number 
of temporal modes contained in the signals illustrated in 
Fig.[5]but also the fact that whenever Bob obtains a click 
in any of these modes then he cannot obtain any other 
click during the following d — \tdf^\ pulses [43]. The 
main idea behind the whole analysis contained in this 
section is to study the behaviour of the possible blocks of 
signals that Bob can receive from Eve after a dead-time, 
together with their a priori probabilities. Every time a 
dead-time finishes we have a new trial of this random 
process. 



Next, we calculate an expression for N^ Ucks (m) and 
N e {m). We shall distinguish several cases, depending 
on the block of signal states that arrives at Bob's side 
after a dead-time. Let us begin with Case A in Fig. [5] 
The probability that Bob obtains a click in this scenario 
depends on the identity of the preceding signal. We shall 
denote with p vv the probability to obtain a click when 
the previous signal is also a vacuum state, and we shall 
denote with p™ k the probability to obtain a click when the 
previous signal is the state IV'™)- These two probabilities 
are calculated in Appendix [TJ] In general, we have that 
p vv > due to the dark counts in Bob's detectors. Let 
Ppv (Ppk) denote the probability that the previous signal 
is a vacuum state (the signal \^p k n ))- These probabilities 
are calculated in Appendix [El With this notation, we find 
that the average total number of clicks in this scenario, 
that we shall represent as N^ hcks q ^ (m) , is given by 



Mr, 



N. 



clicks, q(0) 



(m)=p pv p vv + ^ PpkP™k- 



(23) 



fe=M„ 



Next, we calculate an expression for the average total 
number of pulses, that we shall denote as N^Am), This 
parameter depends on whether Bob's detectors click or 
do not click. In particular, we have that whenever Bob 
obtains a click in his detection apparatus then the total 
number of pulses that we need to consider is 1 + d. That 
is, in this case we need to include the effect of the dead- 
time. Otherwise, the number of pulses is one. We obtain, 
therefore, that 

N q(0) ( m ) = Ppv [P«u(l +d) + (l- p vv )} 
M raaJ 

+ E Ppk\Pvk(l + d) + (l-PZ)] 

k=M min 

M mam 

= P P v(l + dPw) + Ppk(l + d~P™ k )- 



k=M„ 



(24) 



The analysis of the remaining cases included in Fig. [5] is 
similar. Whenever Bob receives a block of k + 1 vacuum 
states (Cases C and E in Fig. with 1 < k < M m i n , it 
is guaranteed that the signal which precedes the block is 
always a vacuum state. This is justified by the particular 
structure of the different blocks of signal states that Eve 
can send to Bob (see Fig. [2]). In this case, due to the dead- 
time of Bob's detectors, Bob can only obtain a click in a 
given temporal mode if the previous modes of the block 
did not click. The average total number of clicks, that 
we shall denote as N^ hcks q ^ (m), can then be expressed 
as 



N 



clicks, q(k) ' 



= 5^(1 -PwTpw = l - (i-p vv ) k+1 . 



n=0 



(25) 

In order to calculate the average total number of pulses, 
that we shall denote as N q ^(m), note that, like before, 
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whenever Bob obtains a click in temporal mode I £ [0, k] 
then the total number of pulses that we need to consider 
is (fc — I) + (1 + d). The first term in the summation, 
(k — I), represents the total number of modes contained 
in the block before the mode that actually clicked (see 
the labeling convention illustrated in Fig. [3]), while the 
second term, (1 + d), includes the effect of the dead- 
time. Otherwise, the number of pulses is k + 1. We find, 
therefore, that N^,^ (m) can be written as 

N e q{k) (m) = (k + l)(l-p vv ) k+1 

k 

+ ^2(n + l + d){l-p vv ) n p vv 

n=0 

= (l + dp vv )[l-(l- Pvv ) k + 1 ] 

Pvv 

When Bob receives a state p\, with 1 < k < M min — 1, fol- 
lowed by one vacuum state (Cases B, D, and F in Fig. [5]), 
then the state which precedes that block of signals can 
never be a vacuum state. Let p k denote the probability 

that /5g stems from the last k temporal modes of a signal 
state IV'™) with M m i n < k < M max , and let q™(k) be 
the average total number of clicks obtained by Bob in this 
scenario. The probability p| is calculated in Appendix IF] 
while the parameter q™(k) can be written as 

cw = E<mH' ( 27 ) 

with p m T . (n) denoting the probability that Bob obtains 
a click in temporal mode n and he does not obtain a click 
in any previous mode I with n < I < k. This last quantity 
is calculated in Appendix|D] With this notation, we have 
that the average total number of clicks in this case, that 
we shall denote as N e ,. , fT ,«(m), can be expressed as 

chcks,r(k — 1) v 11 r 
M mam 

^W(S-i)( m )= E PsC(*0> ( 2 8) 

k=M min 

Similarly, the average total number of pulses has now 
the form 

M max 

^VdM= E P k k n T(k\ (29) 

k=M min 

where the parameter n r k {k) represents the average total 
number of pulses when Bob receives the last fc temporal 
modes of the signal \i> k n ) together with one vacuum state. 
This parameter is given by 

k 

nf(k) = Y.P™k^)[k-n+l + d] 

+ [l- q f(k)](l + k). (30) 



Bob can receive as well a state p k , with M m i n < k < 
M max , followed by one vacuum state (Cases G, H and I in 
Fig. [5]) . Let Ppvfr denote the probability that the preced- 
ing signal is a vacuum state, and let jT_ b e the probability 

that p k e stems from the last k temporal modes of the sig- 
nal state IV'™), with k < k < M max . These two probabil- 
ities are calculated in Appendix lGl Using this notation, 
we obtain that the average total number of clicks in this 
scenario, that we shall denote as N e ,. , , T x (m), 

' chcks,s(k — M m i n ) K n 

with M m i n < k < M max , can be expressed as 

M mam 

KlioksAk-M min )( m )=P P vk€(k)+ E Ppk€(k), 

k=k+l 

(31) 

while the average total number of pulses, that we shall 
denote as -^(fc-M )( m )> can directly be obtained from 
Eq. (|3Tj) just by substituting the parameters q™(k), with 
k<k< M max , by nf(k). 

Finally, N^ Hcks (m) and N e (m) can be calculated by 
adding all these terms together with their a priori prob- 
abilities. That is, 

M mi „ 

N cUcks( m ) = E l(k)N^ llcksMk) (m) 

k=0 
M min -2 

+ E r ( fc ) 7V cfcfc S ,r(fc)M 
fe=0 

M max -M min 

+ s(k)N* HcksAk) (m), (32) 

fc=0 

and similarly for N e (m). 

B. Quantum bit error rate 

The QBER in this strategy is given by Eq. fT3]), with 
the parameter N^ Ucks now given by Eq. (f2"Tj) . In order 
to obtain N^ rrors we follow the same method like in the 
previous section. In particular, this quantity can now be 
expressed as 

oo 

-^errors = ^ ] PmN e rrors( m ) > (^3) 
m— 1 

where N^ rrors (m) denotes the average total number of 
errors obtained by Bob when he receives from Eve the 
different blocks of signal states illustrated in Fig. [5] with 
p k representing the last k temporal modes of any state 
\ip™) with k > k. Note, moreover, that in this scenario 
vacuum states can also produce errors in Bob's detection 
apparatus due to the dark counts. 

The analysis to obtain the parameter N^ rrors (m) is 
completely equivalent to the one included in Sec. IV Al 
to calculate N^ licks (m); basically one only needs to sub- 
stitute Bob's probabilities to obtain a click p vv , p™ k , 
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and p m j- k (n) by the probabilities to obtain an error in 
precisely the same situations when these probabilities 
were introduced. For instance, we need to substitute 
p vv by the probability that Bob obtains an error when 
he receives from Eve a vacuum state and the preced- 
ing signal is also a vacuum state, and similar for the 
other cases. These error probabilities, that we shall de- 
note, respectively, as e vv , e™ k , and p m k ,(n) are calcu- 
lated in Appendix [H] The only exception is the pa- 
rameter N^. ror , k Jm) (Cases C and E in Fig. [8j), with 
1 < k < M m i n . This exception only arises due to the 
notation used in Sec. IV At Bob can obtain an error in a 
given temporal mode n + 1 if the previous modes of the 
block did not clicked; that is, the probability to have an 
error in that mode is (1— p vv ) n e vv . We obtain, therefore, 
that Nl rrors q[k) (m) is now given by 

k 

^errors, q(k)( m ) = — Pvv) n &vv 

71=0 

, ^ ~ Pvv fi _ /■■) _ \fc"| 

— &vv i G vv Pvv ) J ■ 

Pvv 

(34) 



The parameter can be expressed as 

oo 

n^E^cH (36) 

m— 1 

where Nfj (m) denotes the average total number of dou- 
ble clicks obtained by Bob when the signal states p\ il- 
lustrated in Fig. [8J represent the last k temporal modes 
of any state \i>\ n ) ■ 

Again, the analysis to obtain Np (m) is completely 
equivalent to the one included in Sec. IV Al to calculate 
N^ licks (m). We only need to substitute in Eq. (j32]) the 
probabilities to obtain a click p vv , p^ , and p™ k . (n) by 
the probabilities to obtain a double click in the same 
situation. We shall denote these double click proba- 
bilities as dc vv , dc™ k and P™ ckk i n )j an d they are cal- 
culated in Appendix |TJ The only exception is the pa- 
rameter N'jj^ g (fc)( m ) (Cases C and E in Fig. [8]), with 
1 < k < M m i n . The reason for this exception is simi- 
lar to the one presented in Sec. IV Bl for the parameter 
iV e e rror S , (Z (fe)( m )- In particular, N e Dc q[k) {m) can be ob- 
tained from Eq. (|34|) by substituting the probability e vv 
by dc V v 



C. Double click rate 

So far we have considered the case of the standard DPS 
QKD protocol, where only the raw bit rate, together with 
the time slots in which Bob obtains a click, are moni- 
tored. In this section, however, we briefly analyze the 
case of an extended version of the protocol, where Alice 
and Bob can also make use of the double click rate at 
Bob's side to try to detect Eve. That is, every time Bob 
obtains a double click in his detection apparatus he first 
records this event and, afterwards, he selects randomly 
the bit value. This is motivated by the fact that, unlike 
the type of signal states considered in Sec. |lVl now the 
states p\ given by Eq. (fT8j) always present a non vanish- 
ing probability of producing a double click. This means, 
in particular, that Alice and Bob could employ this infor- 
mation to discard those sequential attacks that increase 
the double click rate that they expect due to the statis- 
tical fluctuations in the channel, together with the effect 
of dark counts in Bob's detectors [44j |. 

The double click rate at Bob's side, that we shall de- 
note as D c , is typically defined as D c = Nu c /N, where 
Nd c refers to the average total number of double clicks 
obtained by Bob, and N is again the total number of 
signal states sent by Alice. Nd c can be expressed as 
N Dc = {N/N e )N e Da , with N e given by Eq. (JUj and 
where Nf) denotes the average total number of double 
clicks obtained by Bob when he receives from Eve the 
different blocks of signals illustrated in Fig. [5J With this 
notation, we find that D c can be written as 



D. Evaluation 

In Figs. [H [lOl QT] and \T2\ we plot the gain G versus 
the QBER in a sequential attack for different values of 
the mean photon number p a of Alice's signal states, the 
parameter d, the dark count probability pd and the de- 
tection efficiency rjdet of Bob's detectors, and the photon 
number m of Eve's signal states (45[. These examples 
illustrate the case of the standard DPS QKD protocol 
where Alice and Bob do not monitor separately the dou- 
ble click rate at Bob's side and Eve can select the param- 
eter m without any restriction on the maximum tolerable 
double click rate. As before, these figures state that the 
secret key rate above the curves is zero. 

We fix the value of M max = d and we vary the value 
of the parameters M m i n < M max and q G [0,1] like in 
Sec. IIV CI Moreover, for simplicity, we select the state 
coefficients An} m of the signal states p k e given by Eq. (fT5|) 
as A^n} m — for all m > 1, with A^Jf 1 given by the 
optimal distribution derived in Appendix [B] for the case 
of the untrusted device scenario. It can be shown that 
also in this case this distribution provides a lower QBER 
than the one obtained with a flat or a binomial distribu- 
tion. As expected, the QBER produced by a sequential 
attack starts decreasing as the losses in the channel in- 
crease, and, at some point, it begins to increase again. 
This inflexion point is due to the dark count probability 
of Bob's detectors, which Eve cannot manipulate in the 
trusted device scenario. In particular, when the gain is 
low enough such that most of the clicks obtained by Bob 
originate from the dark counts of his detectors then the 
QBER starts increasing again. In the limit case where all 
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FIG. 9: Gain (G) versus QBER in a sequential attack for 
different values of the photon number m, and for the optimal 
distribution of the state coefficients A^} m derived in Sec. IIVI 
The mean photon number of Alice's signal states is fi a — 
0.2, the parameter d — 500, the dark count probability of 
Bob's detectors isp^ = 2.5 x 10~ 9 , and the detection efficiency 
Vdet = 0.005. The triangles represent experimental data from 
Ref. [H. 



FIG. 11: Gain (G) versus QBER in a sequential attack for 
different values of the photon number m, and for the op- 
timal distribution of the state coefficients An? m derived in 
Sec. IIVI The mean photon number of Alice's signal states is 
fi a — 0.16, the parameter d = 50, the dark count probability 
of Bob's detectors is pd = 2.7 x 10 -7 , and the detection ef- 
ficiency r/det — 0.0045. The triangle represents experimental 
data from Ref. [HI]. (See also Ref. [Ij.) 
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FIG. 10: Gain (G) versus QBER in a sequential attack for 
different values of the photon number m, and for the op- 
timal distribution of the state coefficients A^ln derived in 
Sec. IIVI The mean photon number of Alice's signal states is 
fi a — 0.17, the parameter d — 50, the dark count probability 
of Bob's detectors is pd — 7.8 x 10 -6 , and the detection ef- 
ficiency r)det = 0.0327. The triangle represents experimental 
data from Ref. [3. (See also Ref. 



FIG. 12: Gain (G) versus QBER in a sequential attack for 
different values of the photon number m, and for the op- 
timal distribution of the state coefficients An,m derived in 
Sec. IIVI The mean photon number of Alice's signal states is 
fi a = 0.2, the parameter d = 50, the dark count probability 
of Bob's detectors is pd = 3.5 x 10 -8 , and the detection ef- 
ficiency r/det — 0.0011. The triangles represent experimental 
data from Ref. 0. (See also Ref. [Ij.) 



the detected events arise from dark counts we have that 



the QBER=0.5. Figs.[§[T0l 

imental data from Refs. [if 



also include exper- 
According to our 



results, and for the values of the parameter m considered 
in these examples, we find that the 200 km DPS QKD 
experiment reported in Ref. [2l| together with the 105 
km DPS QKD experiment reported in Ref. [l8| would be 
insecure against a sequential attack even in the trusted 
device scenario. That is, the data of these experiments 



could never be turned into secret key. 

As already suggested in Ref. [23[ , in this QKD protocol 
it is not enough for Alice and Bob to include the effect of 
the double clicks obtained by Bob in the QBER, but it 
might be very useful for the legitimate users to monitor 
also the double click rate to guarantee security against a 
sequential attack. Fig. [T3] shows a graphical representa- 
tion of the gain versus the double click rate for the case 



where fi a = 0.17, d = 50, 



7.8 x 10~ b , f] det = 0.0327, 
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Trusted device scenario: n a =0.17, d=50, pd=7.8E-6, r|det=0.0327 
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FIG. 13: Gain (G) versus double click rate (D c ) in a sequential 
attack for different values of the photon number m, and for 
the optimal distribution of the state coefficients An)m derived 
in Sec. IIVI The experimental parameters coincide with those 
used in Fig. [TO] 

and for different values of the parameter m [HI]. (See 
also Ref. [Ill-) Similar results can also be obtained for 
the experimental parameters used in Refs. [H, HH- As 
expected, the double click rate at Bob's side decreases as 
the losses in the channel increases and the photon num- 
ber m decreases. If Alice and Bob only accept a double 
click rate below the curve which corresponds to the case 
m = 1 then they could always detect the sequential at- 
tacks presented in this section. 



VI. CONCLUSION 

In this paper we have quantitatively analyzed the ef- 
fect that Bob's detectors dead-time has on the perfor- 
mance of sequential attacks against a differential-phase- 
shift (DPS) quantum key distribution (QKD) protocol 
based on weak coherent pulses. A sequential attack con- 
sists of Eve measuring out every coherent state emitted 
by Alice and, afterwards, she prepares new signal states, 
depending on the results obtained, that are given to Bob. 
Whenever Eve obtains a predetermined number of con- 
secutive successful measurement outcomes, then she pre- 
pares a new train of non-vacuum signal states that is 
forwarded to Bob. Otherwise, Eve can send vacuum sig- 
nals to Bob to avoid errors. Sequential attacks transform 
the original quantum channel between Alice and Bob into 
an entanglement breaking channel and, therefore, they do 
not allow the distribution of quantum correlations needed 
to establish a secret key. 

Specifically, we have studied sequential attacks where 
Eve realizes unambiguous state discrimination of Alice's 
signal states. When Eve identifies unambiguously a sig- 
nal state sent by Alice, then she considers this result 
as successful. Otherwise, she considers it as a failure. 
Moreover, we have considered two possible scenarios for 



our analysis. In the first one, so-called untrusted device 
scenario, we assumed that Eve can control some imper- 
fections in Alice and Bob's devices (e.g., the detection 
efficiency, the dark count probability, and the dead-time 
of Bob's detectors), together with the quantum chan- 
nel, and she exploits them to obtain maximal information 
about the shared key. In the second scenario, so-called 
trusted device scenario, we considered that Eve cannot 
modify the actual detection devices employed by Alice 
and Bob. That is, the legitimate users have complete 
knowledge about their detectors, which are fixed by the 
actual experiment. From a practical point of view, this 
last case constitutes a reasonable description of a real- 
istic situation, where Alice and Bob could in principle 
try to limit Eve's influence on their apparatus by some 
counterattack techniques. 

As a result, we obtained upper bounds on the maximal 
distance achievable by a DPS QKD scheme as a function 
of the error rate in the sifted key, and the detection effi- 
ciency, the dark count probability, and the dead-time of 
Bob's detectors. It states that no key distillation protocol 
can provide a secret key from the correlations established 
by the users. While our analysis seems to indicate that in 
the untrusted device scenario all the long-distance imple- 
mentations of DPS QKD reported so far in the literature 
would be insecure against a sequential attack, it also sug- 
gests that, in the trusted device scenario, it might be very 
useful for the legitimate users to monitor also the dou- 
ble click rate at Bob's side. This fact might dramatically 
increase Alice and Bob's ability in defeating sequential 
attacks in this case. 
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APPENDIX A: AVERAGE TOTAL NUMBER OF 
ERRORS e{k) 

In this appendix we obtain an expression for the av- 
erage total number of errors e(k) obtained by Bob when 
Eve sends him a signal state followed by 1 + d vac- 
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uum states (Cases A, B, and C in Fig. [2]). These signal 
states always produce one single click in Bob's detection 
apparatus and, therefore, they can cause at most one 
single error (i.e., e(k) < 1). This error can occur in any 
temporal mode n € [0, k\. The parameter e(fc) can be 
written as 



e(k) 



/ , ir err ? 



It turns out that the probability p^,™ remains constant 
independently of the different possible combinations of 
correct phases 9 n identified by Eve. Therefore, without 
loss of generality, we can assume a fixed value for the 
angles 9 n . In particular, we shall consider, for instance, 
that 9 n — for all n £ [1, k] and, consequently, B n k ^ = 
In this scenario an error occurs when detector 
(Al) D\ clicks. The probability p^.™ can then be expressed as 



where p^.™ denotes the probability that Bob obtains an 
error in temporal mode n. Next, we calculate this prob- 
ability. 

We shall consider that Bob employs the detection setup 
shown in Fig. [T] We will assume as well that his detec- 
tors, DO and Dl, have a detection efficiency equal to 
one, a dark count probability equal to zero, and they 
cannot distinguish the number of photons of arrival sig- 
nals. That is, they provide only two possible outcomes: 
"click" (at least one photon is detected), and "no click" 
(no photon is detected in the pulse). The action of DO 
and Dl in the time slot n can be characterized by one 
positive operator value measure (POVM) that contains 
four elements: D™ ac , Dq, D™, and D£, c . The outcome 
of the first operator D™ oc corresponds to no click in the 
detectors, the following POVM operator Dq (D™) gives 
precisely one detection click in detector DO (Dl), and the 
last one D£, c gives rise to both detectors being triggered. 
If we denote by \p, D1 the state that, in temporal 
mode n, contains p photons in the spatial mode arriv- 
ing to detector DO and q photons in the spatial mode 
corresponding to detector Dl, then the elements of this 
POVM can be expressed as 

D« ac = |0,0)(0,0|£ 0)O1 

oo 
oo 

D?=X>p><0,p|" 0iO1 
P =i 



D Dc = \p^)(p,q\do,di 

p,q=l 



(A2) 



Once the state \tp k ) followed by 1 + d vacuum states 
passes Bob's interferometer, the signal that arrives at 
Bob's detectors, that we shall denote as \ip k ), is given by 



n.DO ®n,Dl + ®n-l,D0 + °n-l,£)l] 1^) 



n=l 



(A3) 

(k) 

followed by d vacuum states. The coefficients B n in 
Eq. JA3) are given by = [A { n ] exp (i9 n )]/2, and 

a n DQ (a n D1 ) represents a creation operator for one pho- 
ton in temporal mode n and in the spatial mode corre- 
sponding to detector DO (Dl). 



p-; = Tr(D?|^)(^|), with |^ fe ) given by Eq. (A3) 
a result, we obtain 



As 



I err 



k,0<n<k 
Perr 



p k,o 

Ferr 



-14 , 

4 

-\A {k) 

]\4 k) \ 2 . 



l(fc)|2 



n I 



(A4) 



Adding all these terms together according to Eq. (|A1[) 
we finally obtain 



e(k) = \ 



k — l 



W|2 



(A5) 



(fc) 



APPENDIX B: OPTIMIZATION OF A 



In this appendix we describe a method to optimize the 
state coefficients introduced in Eq. for the un- 
trusted device scenario. As shown in Sec. IIV Al in this 
case the overall gain G is independent of the chosen dis- 
tribution for these coefficients. This means that the min- 
imum value of the QBER can be attained by optimizing 
the average total number of errors e(fc) independently of 
G. 

The coefficients A„ <G C satisfy the normalization 
condition X)n=il^n^| 2 = ^ n P°i ar coordinates 

each of these coefficients can be expressed as An — 



,( fc ). 



i in' exp(i^/4 )j with an 1 , and ipn' fc 



«.(*) 



tion, the terms \A K n 
,(fc) 



(k) 



~ | 2 — ( a n+l) 2 + ( a rP) 



A ( n k) \ 2 in Eq. 
O) 



With this nota- 
1U1 ) simplify to 



> 



,(*) 

l n+l 



dk)\2 



(Bl) 



(k) (k) 

where equality is obtained iff ip n +i ~ tyn is an even mul- 
tiple of 7r, i.e., both A^}^ and A„ have the same phase. 
Then, without loss of generality, we can always impose 
the phases ip n , with n € [l,k], to be equal to zero. With 
this constraint, together with the normalization condi- 
tion of the state coefficients, one can further simplify the 
parameters e(k) as 



e{k) 



(B2) 
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Now, in order to minimize this quantity one can equiva- 
lently solve the following optimization problem, 



0.1 



fe-i 



minimize c (a£ fe) ) 2 - a^a^ 

n—l n—1 

k 

subject to ^(al fc) ) 2 = 1, 



(B3) 



where c > is an arbitrary positive constant. This opti- 
mization problem can be written in matrix form as 



minimize 



a k \\=if(a k ) = a k M{c)al, 



(B4) 



where the vector a k is defined as a& = (a^\ . . . ,a ( k '), 
and the matrix M (c) = cl - K/2 with K — K T being 
a k x k matrix with ones only on the first off-diagonals 
and zeros elsewhere, i.e., 



K 



/0 1 

1 1 

1 

\ \ \ \ 



J 



(B5) 



The Hessian matrix of the function f(dk) is M(c); hence 
if one selects the constant c such that M(c) > then the 
resulting optimization problem is convex, and it suffices 
to find a local minimum. The solution is given by 



t/(a*) 



y ^max (K), 



=1 a k Ka k 

(B6) 



where X max (K) denotes the maximal eigenvalue of the 
matrix K . The optimal solution for the state coefficients 
An ' coincides then with the elements of the normal- 
ized eigenvector of K that is associated with its maximal 
eigenvalue. 

Fig. [HI shows a graphical representation of e(k) versus 
k for the optimal distribution of An together with the 
flat and the binomial distributions given in Eq. (|17[) . 



APPENDIX C: PROBABILITIES q(k), r(k) AND 
s(k) 

In this appendix we provide the expressions for the 
a priori probabilities of the blocks of signal states illus- 
trated in Fig. [5] q(k), r(k) and s(k). As already ex- 
plained in Sec. [Vj these blocks of signal states arise due 
to the effect of the dead-time of Bob's detectors. In par- 
ticular, in the trusted device scenario it is not guaranteed 
that the first temporal mode that arrives at Bob's side 
once his detectors are recovered from a dead-time coin- 
cides with the first temporal mode of any of the blocks 
of signals considered in Fig. 03 In this scenario, and for a 
given block of signals containing k + 1 modes (see Fig. 02) , 
we shall denote with Pd{n) the probability that the first 
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FIG. 14: The average total number of errors e(fc) versus k 
for different distributions of the state coefficients An . flat 
(solid), binomial (dashed), and the optimal distribution (dot- 
ted). 



temporal mode of the block that arrives at Bob's side af- 
ter a dead-time is mode k — n. That is, Pd{n) represents 
the probability that a dead-time finishes once Bob has 
already received the first n temporal modes of a given 
block of signals. For instance, Pd(0) represents the prob- 
ability that the first mode that arrives at Bob's side after 
a dead-time coincides with the first temporal mode of the 
block, Pd(l) denotes the probability that the first mode 
arriving at Bob's side corresponds to the second tempo- 
ral mode of the block, and so on. Here we use again the 
labeling convention illustrated in Fig. 02 

With this notation, let us now calculate the parame- 
ter q(0), i.e., the probability that Bob receives a vacuum 
state after a dead-time (Case A in Fig. In princi- 
ple, this vacuum state could originate from the last tem- 
poral mode of every block of signal states illustrated in 
Fig. [2] with d = 0. For instance, the probability that it 
originates from the block of signals which contains only 
one vacuum state (Case D in Fig. 02 when the parame- 
ter k = 0) is given by Pd(0)p„(0), where J5„(0) is given by 
Eq. © . In general, we have that the probability that this 
vacuum state arises from a block of signals which contains 
k + 1 vacuum states, with < k < M m i n (Cases D and 

E in Fig. 02), is given by Pd(k)p v {k)/[J2m=n-kPv( m ) + 
M . p s (m')], where the normalization factor 

k p v (m) + ^ m '=°M min Ps( m ') is used to guarantee 
that, for each value of the parameter pd(n), the probabil- 
ities of the different blocks of signal states which contain 
at least n + 1 temporal modes add one. Similarly, we 
find that the probability that this vacuum state origi- 
nates from a block of signals containing a state p k e fol- 



L-^tm—n 



lowed by one vacuum state, with M m i n < k < M max 
(Cases A, B, and C in Fig. 03 with d = 0), can be written 

as Pd(k)p s {k)/{Y^2k*\Pv( m ) +Ps(m))}. After adding 
all these terms together, we obtain that q(0) can be ex- 
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pressed as 



APPENDIX D: PROBABILITIES p vv , p™ k AND 



9(0) 



Mmi, 

E 



Pd(n)p v (n) 



p d (k)p s {k) 



k=M 



Z-^ra— 



\Pv{m) + p 8 (m) 



(CI) 



The analysis of the remaining cases is completely anal- 
ogous. In particular, we find that 



M„ 



*(*) = E 7 

7,, 



- k)p v (n) 

\7t — 1—k 



n—k 



m =o Pvim) 



(C2) 



with 1 < k < M„ 



Mr, 



■(*) = E 



p d (n - 1 - k)p s (n) 
n^M min Em=;_i-fe [Pv(m)+p s (m)] 



(C3) 



with < k < M„ 



M max 

»(*o = E 



2, and 



p d (n - M mi „ - k)p s (n) 



n=M min + k Z-*im=n-M, 



E 



A [p„(m) +p s (m)] 



with < k < M„ 



Mr, 



(C4) 



To conclude, let us present very briefly a numeri- 
cal method to calculate the probabilities pd(n), with 
< n < M max . This procedure is used in Sec. IV Dl 
for the graphical representation of the gain G versus the 
QBER (and also of the double click rate versus G) in 
a sequential attack. For simplicity, let us consider the 
situation where M rnax — \tdf c ~\ ■ That is, each block of 
signal states illustrated in Fig. [8] could produce, at most, 
only one single click in Bob's detectors due to the effect 
of the dead-time. In this scenario, the probabilities Pd{n) 
only depend on whether the previous M max + 1 temporal 
modes which precede a block of signals clicked or did not 
click. Especifically, we have that Pd(0) is given by the 
probability that none of these M max + 1 previous modes 
clicked or it only clicked the first of them. That is, 



M„ 



p d (0) = G + (1 - G) 

Similarly, Pd(n), with 1 < n < M ma 
as 

Pd (n) = G(l - G) 7 



(C5) 

can be expressed 



(C6) 



Then, in order to obtain pd(n) an plot the figures in- 
cluded in Sec. IV D) we perform several iterations for each 
value of the gain G. First, we calculate the probabilities 
Pd{n) according to Eq. (|C5|) and Eq. (|C6|) and, with these 
probabilities, we obtain a new value for the gain G. We 
repeat this procedure several times until the value of G 
converges to a constant value. 



u c,k,k\ 



In this appendix we obtain an expression for the prob- 
abilities of obtaining a click at Bob's side: p vv , p™L and 
P m k fc( n )' introduced in Sec. IV Al 

Let us start by describing Bob's detectors DO and Dl 
in the trusted device scenario. As already introduced in 
Sec. El these detectors are characterized by their detec- 
tion efficiency r]det, their dark count probability pd, and 
their dead-time. The detection efficiency of DO and Dl 
can be modeled by a combination of beam splitters of 
transmittance rjdet and ideal detectors (46[. This model 
can be simplified further by considering that both detec- 
tors have the same detection efficiency. In this situation, 
it is possible to attribute the losses of both detectors 
to a single-loss beam splitter which is located after the 
transmission channel. Moreover, like in Sec. IIV( we shall 
assume that DO and Dl cannot distinguish the number 
of photons of arrival signals, but they provide only as 
possible outcomes "click" and "no click" . This means, in 
particular, that the action of Bob's ideal detectors can be 
characterized by the POVM given by Eq. (|A2|1 . Further- 
more, the noise introduced by DO and Dl due to their 
dark counts can be considered to be independent of the 
incoming signals. Note that the clicks that Bob observes 
can be thought as coming from a two-step process: in the 
first step the signal states sent by Eve can produce clicks 
in his detectors, while in the second step random clicks 
from the detector's dark counts is added. 

Next, we calculate an expression for the probability 
P™k fc( n )' ^ or that, we obtain first the probability that 
Bob's detectors fire due to the signal states sent by Eve 
only, i.e., without taking into account the dark counts 
of DO and Dl; afterwards we will include in the analysis 
the effect of the dark counts of the detectors. 

Once a state followed by one vacuum state, 

passes Bob's interferometer together with the beam split- 
ter which models the losses of his detectors, the signal 
that arrives at Bob's ideal detectors, that we shall de- 
note as IV'™), i s gi ven by 



1 



K K 

[E^"<^l+ F "<™)+E G " 



bl 



10), 
(Dl) 

where a n D0 (o^ fll ) represents again a creation opera- 
tor for one photon in temporal mode n and in the spatial 
mode arriving to detector DO (Dl), b\ denotes a creation 
operator for one photon in temporal mode n and in the 
spatial mode that goes out of the beam splitter that mod- 
els the losses of the detectors, and the coefficients E™, 
F™, and G™ are given by 



E™ = 



V A k.m e 



if n = 

ifl<n<fc-l 
if n = k, 

(D2) 
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with 77 = y/rjdet/2, 



Fl: 



and 



k,m 



if n = 

if 1 < n < k 

if n = k. 



(D3) 



Gri 



V 1 ~ VdetA^ m 



(D4) 



respectively. 

Let p"c^ k { n ) denote the probability that Bob obtains 

a click in mode n, with < n < k, and he does not 
obtain a click in any previous temporal mode I, with 
?i < I < k, when he receives the last k temporal modes of 
a signal state I^Mf 1 ) followed by one vacuum state. This 
probability can be expressed as 



where P^ feD0 (™) (Ps^iM) represents the probability 
that only detector DO (Dl) clicks in temporal mode n, 



and p 



k,k,D D 



(n) denotes the probability that both detec- 



tors DO and Dl click in temporal mode n [47 
probabilities are given by 



These 



J k.k.D 



4 (n) = Tr 



I=n+1 



(D6) 



where the POVM elements D l vac and with i € 

{0,1, Z? c }, are given by Eq. (|A2[) . After some calcula- 
tions, we obtain that these probabilities can be written, 
respectively, as 



E 

£ 3fc +i t r =rr 
^ r— 



I0o i£[n,k] 



n ^ 



j~| |^pm|2t u + fc+1) j~| |£m|2t (s+2fe+1) ^ 



3'£[n+l,fc] 



lf*.zn(«) 



\ " 

t r 



n 



T=0 
f„>l 



i=0 
ig[»+l,k] 



JJ | F m|2t u + fc+1) jj | G m|2t ( 



3'£[n,fe] 



E 

V 3 ^ 1 . tr =r. 

t(fe+„+l)>l 
t„>l 



n3fc+l , I 



II O^n 4 * 



i=0 
»g[n+l,k] 



x IF/' 



"l|2t( s + 2 fc+l) 



(D7) 



where the sets of indexes io , -fi and Idc are given by: Jo = 
[n, k]{J[n+k+2,k+k+l], h = [n+l,k]l)[n+k+l,k+k+i\ 
and I Dc = [n + 1, k] U [n + k + 2, A; + k + 1]. It turns 
out that the probability P™ k k { n ) remains invariable in- 
dependently of the different possible combinations of cor- 
rect consecutive phases 9 n identified by Eve. Therefore, 
without loss of generality, we can always assume a fixed 
value for the angles 9 n ; for instance, we can consider that 
9 n = for all n € [l,k]. This means, in particular, that 
the parameters E™, F™ and G™ that appear in Eq. (|E>7|) 

depend only on the state coefficients AnJn and the de- 
tection efficiency of Bob's detectors. 

In order to include the effect of the dark counts of DO 
and Dl in the analysis, let us define the parameter Pd as 



P d =p d {2-Pd) 



(D8) 



This is the probability to have a click at Bob's side in 
a given time slot due to the dark counts of his detectors 
only. As already mentioned in Sec. IV Al here we consider 
that double click events are not discarded by Bob. Every 
time Bob obtains a double click, he just decides randomly 
the bit value (42J. With this notation, it turns out that 
the probability that Bob obtains a click in temporal mode 
n, with < n < k, and he does not obtain a click in any 
previous mode I, with n < I < k, due to the dark counts 
of his detectors only, probability that we shall denote as 

m.d/ \ l 



m.d / \ 



p d (i - P d ? 



(D9) 
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Combining Eq. (|D5|) and Eq. (|D9[) . we obtain that the 
probability p m k , (n) can be expressed as 



(n)(l-P d r- n +p™£(n)pf XDv Jn) 



.k.k 



\ip™) (Cases A, B and C in Fig. [2] when the number of 
photons contained in p\ is equal to m). After normalizing 
by the factor q(0) we find that p p k is given by 



P P k = 



p d (k)p s (k) 



?(°)£m=r [Pv(m) + p s (m)] ' 



(E2) 



where P™ k DvaB (») is given by Eq. (JD6J) with Dj = D„ oc , 
i.e., it represents the probability that Bob does not ob- 
tain a click in any temporal mode I, with n < I < k, due 
to the signals sent by Eve only. This probability can be 
written as 



f i 
=( 



in 



t—' r— 



3fe+l 

Ith.aa i£[n,k] 
k 



n 



x |f™|W + D] 2 J|" | G ™|2t (s+2fc+1)] ( D11 ) 
s=l 

with the set I vac = [n, k] U [n + k + 1, + k + 1], 

Finally, we obtain an expression for the probabilities 
Put, and p^j. . The first one, p w , represents the probability 
that Bob obtains a click when he receives a vacuum state 
and the preceding signal is also a vacuum state. This 
probability has the form p vv — Pd, where Pd is given 
by Eq. (|D8|) . Similarly, p™ k denotes the probability that 
Bob obtains a click when he receives a vacuum state and 
the preceding signal is the state \ip™)- This probability 
is given by p™ k = p™ k {0), where p m r An) is defined in 
Eq. (iDTOl) . 



APPENDIX E: PROBABILITIES Ppv AND Ppk 

In this appendix we obtain an expression for the prob- 
abilities p pv and p p k- Let us begin with p pv , i.e., the 
probability that the signal which precedes a vacuum state 
(Case A in Fig. [5]) is also a vacuum state. 

As shown in Appendix [Cl after a dead-time Bob 
receives a vacuum state with a probability given by 
Eq. (jCip . The first summation in Eq. (|Cip refers to 
the probability that this vacuum state originates from 
a block of signal states containing only vacuum pulses 
(Cases D and E in Fig. [2]). We have, therefore, that p pv 
can be written as 



Ppv 



1 



M min 

E 

71=0 



Pd{n)p v (n) 
-Em=oP«( m )' 



(El) 



where the normalization factor q(0) is used to guaran- 
tee that p pv + ^ M mM p p k = 1. Similarly, each term 

Pd(k)p s (k)/Y,m=r [Pv(m) + p s (m)] that appears in the 
second summation of Eq. (jClj) represents the probability 
that Bob receives a vacuum state preceded by a signal 



APPENDIX F: PROBABILITY pf 

In this appendix we calculate the probability p^ with 

1 < k < M min — 1, i.e., the probability that p k e represents 
the last k temporal modes of a signal state with 
M mm <k< M max (Cases B, D, and F in Fig.©. 

As shown in Appendix [Cj after a dead-time Bob 
receives the signal p\ followed by one vacuum state 
with probability r(k — 1), where the probability r(k) 
is given by Eq. (|C3j) . Each term Pd{n — 1 — 

l)p s (n)/ J2 m =n--\-i\Pv ( m ) + Ps( m )] triat appears in the 
summation of Eq. (|C3j) denotes the probability that Bob 
receives a state p 1 ^ 1 which corresponds to the last I + 1 
temporal modes of a signal After substituting 

I + 1 = k and n — k, and normalizing by the factor 
r(k — 1) we find that p 1 ^ is given by 



p d (k - k)p s (k) 



r(k 



(Fl) 



APPENDIX G: PROBABILITIES p p „ s AND p 



In this appendix we obtain an expression for the prob- 
abilities p pvk and p i.e., the probability that the signal 

state Pg received by Bob, with M min < k < M max , is 
preceded by a vacuum state, and the probability that 
represents the last k temporal modes of with 
k < k < Mmaxi respectively (Cases G, H and I in Fig.©. 

As shown in Appendix [Cl after a dead-time Bob re- 
ceives the signal state p\ with a probability given by 
Eq. (|C4|) . This probability can be equivalently written 



s(k - M mm ) 



M max 

E 



p d {n - k)p s (n) 



n= ~ k E m Z7-k [Pv(m) + p s (m)] 



(Gl) 



with M m in < k < M max - The first term in the sum- 
mation given by Eq. (|G1[) . i.e, the case n — k, refers to 
the probability that Bob receives a state p k e — \^p k n ){i^ k n \- 
Because of the particular structure of the blocks of signal 
states that Eve can send to Bob (see Fig. [5]), these states 
are always preceded by a vacuum state. After normaliz- 
ing by the factor s(k — M m m) we obtain, therefore, that 
Ppvk is gi ven b Y 



Ppvk 



Pd(0)p s (k) 

S(k~ Mmm) 



(G2) 
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Similarly, each term p d (n - k)p s (n)/ J2 m =n-k\Pv( m ) + 
p s (m)} that appears in Eq. (|Glj) . with k < n < M max , 
represents the probability that Bob receives a state p k 
which originates from the signal state IV 1 ™) ■ We find, 
therefore, that 



v k - 
P p k 



p d {k - k)p s {k) 



s(k - M min ) Y^n=k~k\P-"( n ) + Ps( n )} 



(G3) 



The normalization factor s(k — M m i n ) included in 



Eq. QG2J) and in Eq. 

V Mm - ax v k - = 1 



G3|) guarantees that p pvk 



APPENDIX H: PROBABILITIES e„ 



AND 



In this appendix we obtain an expression for the er- 
ror probabilities e vv , e™ k , and p m k k (n) introduced in 
Sec. IVBl 

Let us start with the parameter e vv , i.e., the probabil- 
ity that Bob obtains an error when he receives from Eve 
a vacuum state and the preceding signal is also a vacuum 
state. This quantity is given by e vv = pd(l — Pd) + Pd/2, 
where pd denotes the dark count probability of Bob's de- 
tectors. This quantity can be further simplified as 



1 



:Pd 



(HI) 



with P d given by Eq. (|D8j) . 

The parameter p™ k k (n), i.e., the probability that Bob 
obtains an error in temporal mode n and he does not ob- 
tain a click in any previous temporal mode I, with n < I < 
k, when he receives the last k temporal modes of the sig- 
nal followed by one vacuum state can be calculated 
as the probability that Bob obtains a click in the "wrong" 
detector and no click in the "correct" one, together with 
one half the probability that he obtains a double click. 
Like in Sec. UVBl the total error probability in this strat- 
egy remains invariant independently of the different pos- 
sible combinations of correct phases 9 n identified by Eve. 
For simplicity, therefore, we can consider again that all 
these phases are equal to zero. This means, in particular, 
that in this situation the "wrong" detector corresponds 
to detector Dl. The probability p™ k k (n) can then be 



= \Pf,k,Dl( n ) 

{n)(l-P d ) k - r 

\k- 



P 



k,k,Do- 



(n)/2](l 



expressed as p r ' 

Pd f-n+i +pf kDvac („)(1 - P d ) k - n Pd/2 + [pl km (n)/2 - 
Pf,k, Dn M)Md -P d )' k - n Pd(l - Pd) + \pf ik ' m (n)/2 + 
Pk,k, D J n )/ 2 + Pf,k,Di WK 1 - p d) k - n Pd(l - Pd) + 

where the parameters p r T n ,„ ^An), pT,„ ^An) and 



k,k,DQ 



Pk,k,D D S n ) are § iven h y Ec f <E3)' and Pi)k,D va S n ^ is 

given by Eq. (|DTTj) . This quantity can be further simpli- 
fied as 



Plk,M 



l-?JlCun(») 



(1 - Pdf- 

PdPk,k,Do( n ) , Ptk,D D S n ) 



Pd 



(H2) 



Similarly, the parameter e™ k , i.e., the probability that 
Bob obtains an error when he receives a vacuum state 
and the preceding signal is the state IV'™) has the form 



fCo,k(°)> with p™ An) given by Eq. JH2 



APPENDIX I: PROBABILITIES dc vv , dc™ k AND 

p7c,k,A n ) 

In this appendix we obtain an expression for the double 
click probabilities dc vv , dc™ k and k , (n) introduced in 
Sec. EC] 

The probability dc vv , i.e., the probability that Bob ob- 
tains a double click when he receives from Eve a vacuum 
state and the preceding signal is also a vacuum state is 
given by 



dc V/ 



(II) 



where pd denotes again the dark count probability of 
Bob's detectors. 

The parameter k . ( n) , i.e., the probability that Bob 
obtains a double click in temporal mode n and he does 
not obtain a click in any previous temporal mode I, with 
n < I < k, when he receives the last k temporal modes of 
the signal IV'™) followed by one vacuum state is given by 



P. 



(n) 

Pd) k - n p 2 d 



dc,k.k 



p 



k.k,D L 



(n)(l-P d 



,fc-r 



P 



k,k,D va 



(n)(l 



KkdM+pIkdJ^ 1 - P d ) k - n P^ - 

P^) + iPlk.DO^+PT.k.Dj^ 1 - P d ) k - n P4l~P d ) + 

[P^oW+^iW+^^WlC 1 -^)'-^. This 
quantity can be further simplified as 



P£,S» = ( l -P^ k ~ n {P4Ptk,Di(n)+pf, k , m (n)] 

+ Pk\ DD S^+P 2 d Pk\ D ^)\ (12) 

Finally, the parameter dc™ k , i.e., the probability that 
Bob obtains a double click when he receives a vacuum 
state and the preceding signal is the state |"0 m ) has the 



form dc* = pZ , k (0), with p™ k k (n) given by Eq. (E 
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